Patent application number | Description | Published |
20160103878 | MONITORING SERVICE-LEVEL PERFORMANCE USING KEY PERFORMANCE INDICATORS DERIVED FROM MACHINE DATA - One or more processing devices create one or more entity definitions that each associate an entity with machine data pertaining to that entity and create a service definition for a service provided by one or more entities. The service definition includes an entity definition for each of the one or more entities. The one or more processing devices create one or more key performance indicators (KPIs). Each KPI is defined by a search query that produces a value derived from the machine data identified in one or more of the entity definitions included in the service definition. Each value is indicative of how the service is performing at a point in time or during a period of time. | 04-14-2016 |
20160103883 | AUTOMATIC ENTITY DEFINITIONS - Methods are disclosed to take advantage of the early collection of machine data from a new or changed entity in a computing environment in order to update the definitional information about entities used by a service monitoring system. In some embodiments, the process undertaken to recognize new or changed entities in an IT environment from collected machine data may be informed by the expertise of a particular subject matter area by installing that intelligence in a codified form packaged as a domain add-on to the service monitoring system. | 04-14-2016 |
20160103887 | DEFINING A NEW SEARCH BASED ON DISPLAYED GRAPH LANES - A system, method and graphical user interface (GUI) for creating a new correlation search based on a set of displayed graph lanes. The graph lanes may provide graphical visualizations of key performance indicators (KPIs) associated with one or more services and may assist a user in identifying a situation (e.g., problem or a pattern of interest) in the performance of the services. A user may adjust (e.g., add graph lanes, zooming-in) the graph lanes in order to display the situation, at which point the user may submit a request to create a new correlation search to detect if the situation reoccurs. The system may generate the new correlation search by iterating through the set of graph lanes and analyzing the fluctuations of each KPI to determine triggering criteria. The system may then run the correlation search and generate a notable event or alarm when the situation reoccurs. | 04-14-2016 |
20160103888 | AGGREGATE KEY PERFORMANCE INDICATOR SPANNING MULTIPLE SERVICES - Techniques are disclosed for providing an aggregate key performance indicator (KPI) that spans multiple services and for receiving user adjustment to KPI factors to configure an aggregate KPI (e.g., heath score). The techniques may enable a user to select KPIs and to adjust weights (e.g., importance) associated with the KPIs. The weight of a KPI may affect the influence a value of the KPI has on the calculation of an aggregate KPI value. The techniques may also include the ability to create a correlation search using the selected KPIs and weights so that a notification may be generated when the aggregate KPI value exceeds a threshold. | 04-14-2016 |
20160103889 | DEFINING A GRAPHICAL VISUALIZATION ALONG A TIME-BASED GRAPH LANE USING KEY PERFORMANCE INDICATORS DERIVED FROM MACHINE DATA - A service monitoring system receives a selection of key performance indicators (KPIs) that each indicate a different aspect of how a service provided by one or more entities is performing. Each entity of the one or more entities produces machine data or wherein each entity has its operation reflected in machine data not produced by the entity. Each KPI is defined by a different search query that derives one or more values from the machine data pertaining to the one or more entities providing the service, where each of the one or more values is associated with a point in time and representing the aspect of how the service is performing at the associated point in time. For each of the selected KPIs, the service monitoring system derives the one or more values and causes display of a graphical visualization of the derived one or more values for the KPI along a time-based graph lane. The graph lanes for the selected KPIs are parallel to each other and the graphical visualizations in the graph lanes are all calibrated to a same time scale. | 04-14-2016 |
20160103907 | MONITORING OVERALL SERVICE-LEVEL PERFORMANCE USING AN AGGREGATE KEY PERFORMANCE INDICATOR DERIVED FROM MACHINE DATA - One or more processing devices derive a value for each of a plurality of key performance indicators (KPIs). Each KPI indicates a different aspect of how the same service provided by one or more entities is performing at a point in time. Each KPI is defined by a search query that derives the value for that KPI from machine data associated with the one or more entities that provide the same service. The one or more processing devices calculate a value for an aggregate KPI for the same service from the values for each of the plurality of KPIs. | 04-14-2016 |
20160103908 | OPTIMIZED COMMON INFORMATION MODEL - Technologies are disclosed for providing a common information model. Features include: detecting a scheduled time for a key performance indicator reflecting how a service provided by one or more entities is performing, entity definition information recording the association between the entities and its machine data, service definition information associating the entities that provide the service, and the KPI being defined by a search query, including a field identifier specified in a data model, the KPI derives a value from the machine data; performing the query in response to said detecting, including: associating values in the machine data having disparate field names in accordance with disparate schemas with the field identifier specified in the data model, and processing the associated values as semantically equivalent data instances. In doing so, values having the same semantic (or related semantics) can be used together despite being associated with disparate field names from disparate schemas. | 04-14-2016 |
20160103909 | THRESHOLDS FOR KEY PERFORMANCE INDICATORS DERIVED FROM MACHINE DATA - One or more processing devices access a service definition for a service provided by one or more entities that each produce machine data or about which machine data is generated. The service definition identifies the entities that provide the service and, for each entity, identifying information for locating machine data pertaining to that entity. The processing devices access a key performance indicator (KPI) for the service that is defined by a search query that produces a value derived from the machine data pertaining to the entities identified in the service definition. The value indicates how the service is performing at a point in time or during a period of time and indicates a state of the KPI. A graphical interface is displayed and an indication of at least one threshold, which defines an end of a range of values representing a state of the KPI, for the KPI is received. | 04-14-2016 |
20160104090 | STATE DETERMINATION USING PER-ENTITY THRESHOLDS - A GUI displays information about a service, such as a service in an IT environment, and the specification for a related key performance indicator (KPI). The service can be provided by a number of entities (e.g., servers) for which machine data is generated and collected. The KPI is defined by a search query that produces a KPI value from the relevant machine data. Thresholds can aid in translating KPI values into a simpler, and possibly, common set of state values (e.g., Normal, Warning, Critical). A user can supply via a GUI, one or more thresholds that are applied on a per-entity basis in the process of determining a state value for the KPI. | 04-14-2016 |
20160104091 | TIME VARYING STATIC THRESHOLDS - A system, method, and graphical user interface (GUI) are disclosed for defining and applying time varying static thresholds. Time varying static thresholds may enable a user (e.g., IT manager) to define multiple sets of key performance indicator (KPI) thresholds that vary over time, for example, one set may apply during week-days and another set may apply on weekends. This may enable a user to have thresholds that take into account cyclical patterns of behavior (e.g., repeat every week). The KPI thresholds may be based on any unit of time, such as an hour of the day, days of the week, a month of the year (such as a holiday season). Each set may include KPI thresholds that specify values that when exceeded may initiate an alert or some other action. | 04-14-2016 |
20160104093 | PER-ENTITY BREAKDOWN OF KEY PERFORMANCE INDICATORS - A service monitoring system (SMS) produces key performance indicator (KPI) scores that indicate the performance of a service. To produce the KPI scores, the SMS may process the data for a large number of machine entities that perform the service. This data can be processed on a per-entity basis to produce a per-entity KPI score representing the contribution of a particular machine to the overall KPI. The per-entity KPI scores can be transformed to statistical representations which can be visualized as a distribution stream graph. The visualization may be presented with interactive aspects. | 04-14-2016 |
20160105325 | TOPOLOGY NAVIGATOR FOR IT SERVICES - Techniques are disclosed for providing a topology navigator that may enable a user to view performance information for multiple IT services associated with a user's IT environment. The topology navigator may include multiple display components for displaying information about the services. A first display component may display multiple services as a graph of interdependent service nodes and a second display component may display information about one or more of the service nodes. The topology navigator may enable a user to visually inspect the aggregate KPI (e.g., health score) of multiple services to identify dependent services that are of interest (e.g., low performance) and navigate through the services to identify dependent services that may adversely affect a service of interest to the user. In one example, the second display component may display key performance indicators (KPIs) associated with the dependent service and the user may select one or more of the KPIs to add them to another display component for further analysis. | 04-14-2016 |
20160105330 | MONITORING SERVICE-LEVEL PERFORMANCE USING A KEY PERFORMANCE INDICATOR (KPI) CORRELATION SEARCH - One or more processing devices cause display of a graphical user interface (GUI) that includes a correlation search portion that enables a user to specify information for a key performance indicator (KPI) correlation search definition. The KPI correlation search definition includes search information and trigger determination information. The search information identifies KPI values, indicative of the KPI states, in a data store. The trigger determination information includes trigger criteria. The trigger determination evaluates the identified KPI values using the trigger criteria to determine whether to cause a defined action. A contribution threshold for a particular KPI definition is received via the GUI. The contribution threshold corresponds to a particular KPI state. The contribution threshold is stored as trigger criteria information. Each of the KPI values is derived from machine data pertaining to entities identified in a service definition using a search query specified by a KPI definition for the service. | 04-14-2016 |
20160105335 | SERVICE MONITORING INTERFACE - Services in an operating environment are represented by stored service definitions that identify entities that perform the service. Entity definitions identify machine data pertaining to the entity. A key performance indicator (KPI) of the service characterizes the service on the whole or some aspect of it. Each KPI is defined by a search query that derives a value from machine data identified in the entity definitions. Processing devices cause display of a service-monitoring page having a services summary region and a services aspects region. The summary region displays interactive summary tiles that each correspond to a service and present information about an aggregate KPI that characterizes the service. The aspects region displays interactive aspect tiles that each correspond to a KPI characterizing some aspect of an associated service. Additional information may be included in the service-monitoring page and interaction features enable a user to navigate to enhanced information displays. | 04-14-2016 |
20160105338 | GRAPHICAL USER INTERFACE FOR ADJUSTING WEIGHTS OF KEY PERFORMANCE INDICATORS - Techniques are disclosed for providing an aggregate key performance indicator (KPI) that spans multiple services and for providing user adjustment to KPI factors via a GUI that enables a user to configure an aggregate KPI with feedback that better characterizes the performance of the services. The GUI may enable a user to select KPIs and to adjust weights (e.g., importance) associated with the KPIs. The weight of a KPI may affect the influence a value of the KPI has on the calculation of an aggregate KPI value (e.g., score). The GUI may provide near real-time feedback concerning the effect the weights have on the aggregate KPI value by displaying the aggregate KPI value (e.g., score) and updating the aggregate KPI value as the user adjusts the weights. | 04-14-2016 |